Loading malware…
MAPMAKER is a port monitoring and local network reconnaissance tool associated with APT38, a subgroup of the North Korea-linked Lazarus Group/Bluenoroff. The provided content states that APT38 installed MAPMAKER on victim systems to print active TCP connections on the local system, indicating its use for post-compromise network connection discovery and situational awareness on compromised Windows hosts. MAPMAKER is explicitly listed among malware associated with BlueNorOff. High-confidence behavior described in the content is limited to enumerating or printing active TCP connections; no additional infection vector, persistence mechanism, or industry-specific targeting is directly provided in the source content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Malware associated with BlueNorOff include: "DarkComet, Mimikatz, Nestegg, Macktruck, WannaCry, Whiteout, Quickcafe, Rawhide, Smoothride, TightVNC, Sorrybrute, Keylime, Snapshot, Mapmaker, net.exe, sysmon, Bootwreck, Cleantoad, Closeshave, Dyepack, Hermes, Twopence, Electricfish, Powerratankba, and Powerspritz"
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family associated with BlueNorOff operations.
Port monitoring tool used to enumerate/print active TCP connections on a compromised host.
Tool used to monitor/print active TCP connections on a local system (network connection discovery/reconnaissance).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.